EUVD-2026-51626
GHSA-98pp-vccm-qm25
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation requires non-default Apache multi-extension PHP handler; PR:L because a backend account with media[upload] permission is mandatory; full C/I/A:H because successful exploitation yields arbitrary PHP code execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
AnalysisAI
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must simultaneously be true for exploitation to succeed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.5 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is independently defensible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a REDAXO backend account with media[upload] permission crafts a JPEG/PHP polyglot - a valid JPEG file with embedded PHP code - and names it shell.php.any.jpg, then uploads it through the media pool UI; the isAllowedExtension check passes because the terminal extension is jpg and neither str_ends_with check matches the three-segment pattern. On an Apache server configured with AddHandler application/x-httpd-php .php, the attacker then sends an HTTP GET request to the public URL /media/shell.php.any.jpg, which Apache routes to the PHP interpreter due to the intermediate .php segment, executing the embedded PHP payload as the web-server user. … |
| Remediation | Upgrade REDAXO Core to version 5.21.1, available at https://github.com/redaxo/core/releases/tag/5.21.1; the fix commit is 462e36896bb65d292ba22d711044c23c9cfb0340 (https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all REDAXO CMS instances in your environment and verify their version numbers to determine exposure to versions 5.18.2 through 5.21.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today